Monitoring, backups and recovery
What we record, for how long, and how we bring the service and your data back.
Logging and monitoring
Every region's logs kept a year, reviewed around the clock by our own security monitoring.
- Application, analysis and network logs are kept for 365 days in each region, without file contents, secrets, passwords, tokens or form contents.
- Every action in the cloud account is recorded by AWS CloudTrail with tamper-evident validation and kept for 365 days.
- Security events from these sources, network records, threat detection findings and a daily check of the cloud account's configuration against recognised security benchmarks are reviewed by our security monitoring, around the clock.
- That monitoring runs on a dedicated server in our AWS account in India, reachable only through our private network. It reads every region through a read-only role, keeps what it reads searchable for 90 days and keeps its event and alert records for a year.
- The web application firewall's records of requests to the app of every region are kept in India for 365 days, with cookies and credentials removed.
| Record | Kept for | Content and access |
|---|---|---|
| Database and file backups | 14 days | Used to recover the service and, at the request of a verified owner of an organisation and on a best-effort basis, to try to restore a product, release, code repository or report that was erased from Recently deleted less than 14 days before. Deletion instructions are applied again after any restore of the service, and data erased with an account or an organisation, on a request to erase or at the end of a retention period is never restored. |
| Application, analysis job and vulnerability data logs (Amazon CloudWatch) | 365 days, in each region | Request identifiers, page and method names without query strings, results and timings. Never file contents, source code, secrets, passwords, tokens or the contents of forms. Restricted to security and operations staff. |
| Network flow records of refused connections | 365 days, in each region | Addresses and ports of connections the network refused, for security monitoring. |
| Cloud account audit trail (AWS CloudTrail) | 365 days, in each region; a replaced copy 30 days more | Who changed what in the cloud account, with tamper-evident log file validation. Restricted to security staff. |
| Records of requests to the app (AWS WAF), for every region | 365 days, in India | The address a request came from, its time, the page or method asked for and the firewall's decision; cookies, sign-in and API credentials are removed before the record is written. Restricted to security staff. |
| Email delivery suppression list (Amazon SES) | Until a verified request removes the address | Addresses whose mail bounced permanently or that complained, so that no further email is sent to them. |
Backups and recovery
Backups kept 14 days in locked vaults, with a copy in a second region of the same country or bloc.
- The database keeps 14 days of automated backups with point-in-time recovery, and the database and the files are also backed up every night.
- A product, release, code repository or report that an owner or admin deletes stays 14 days in Recently deleted, where an owner or admin can restore it, and is then erased with its files.
- For 14 days after that, at the request of an owner of the organisation verified in the app and by a reply from the owner's account email address, our staff can try to restore it from the backups: into a separate copy that is deleted afterwards, bringing back only that organisation's data, with two staff members involved and every step recorded. Such a restore is best effort and not guaranteed.
- Data erased with an account or an organisation, on a request to erase or at the end of a retention period is never restored.
| Data | Recovery mechanism | Schedule and limits |
|---|---|---|
| Application database (accounts, organisations, analysis results, risks, reports and audit log) | Amazon RDS for PostgreSQL, encrypted with AWS KMS, with automated backups and point-in-time recovery, and a nightly backup in a locked vault, copied to a second AWS region (in India for the India region, in Ireland for the European Union region, in the United States for the United States region) | Recovery window of 14 days, in the organisation's region; nightly backups are kept 14 days in a locked vault. A restore returns the database to a point within the window, after which deletion instructions received since that point are applied again. |
| Firmware images, kept source code, generated reports and organisation data exports | Amazon S3, encrypted with AWS KMS, in the organisation's region, keeping the previous version of a changed or deleted file, and a nightly backup in a locked vault, copied to a second AWS region (in India for the India region, in Ireland for the European Union region, in the United States for the United States region) | Previous versions and backups are kept 14 days, so a deleted file is gone from them within 14 days of its deletion. |
| Source code sent for scanning | Stored with the other files while it is kept | Fetched or uploaded into the scan's own isolated job and deleted when the scan ends, unless the organisation's owners or admins choose to keep it for a period (30 days to ten years). Code in storage when a nightly backup runs is in that backup until it expires, 14 days later. |
| Application releases and configuration | Reviewed release images and infrastructure definitions used to rebuild the service | Rebuilding the service does not restore customer data; that comes only from the database recovery described above. |